Adversarial sample generation method for face recognition system in physical domain

Abstract

The invention discloses an adversarial sample generation method for a face recognition system in a physical domain. According to the adversarial sample generation method, a glasses-shaped adversarialdisturbance block which can be reproduced in the physical domain is generated through a generator to mislead the face recognition system; meanwhile, by consideration of the influence of different illumination and printer chromatic aberration, data enhancement is carried out through simulation of illumination changes, and the success rate of attack in the physical domain is improved by utilizing aplurality of loss function combinations. Moreover, different face recognition networks are accessed to an overall training framework, so digital domain adversarial samples for different face recognition methods can be conveniently and quickly generated, and adversarial disturbance can be physically reproduced. With the adversarial sample generation method provided by the invention, attacks on theface recognition system in the physical domain are effectively achieved; meanwhile, the problem that the system lacks enough adversarial samples in the training process is effectively solved; a largenumber of adversarial samples can be rapidly generated to train the network, so the reliability of the network is improved; meanwhile, the adversarial samples can be physically reproduced and have robustness to illumination changes.

Description

technical field [0001] The invention relates to the technical fields of computer vision and biometrics, and in particular to a method for generating an adversarial example for a face recognition system in the physical domain. Background technique [0002] Face recognition technology has achieved vigorous development in recent years, especially with the development of deep learning technology, with the support of sufficient training data and computing power, many face recognition systems based on deep neural networks have achieved good results. recognition effect. However, deep learning technology is vulnerable to adversarial attacks, that is, through subtle perturbations on the input that are imperceptible to the human eye, the deep neural network can output any desired classification with a high degree of confidence, which reveals the existence of deep learning systems. On the other hand, adversarial attacks can be implemented in the physical domain, that is, by creating p...

AI Technical Summary

Problems solved by technology

However, using GAN to generate the anti-perturbation of the shape of the glasses makes the generated adversarial samples unstable. At the same time, it is necessary to collect glasses pictures in advance to build a database to train GAN, which is time-consuming and laborious; The attack success rate in the physical world with changing conditions is greatly affected and it is difficult to generalize to new environments, which also greatly reduces the practical significance of the generated adversarial samples

Images